Threat Source newsletter (Oct. 7, 2021)
Summary: Cisco Talos reported that threat actors set up a phony Amnesty International website promising a tool to protect against NSO Group's Pegasus spyware, but the download installs the little-known Sarwent malware, a remote access tool that can also activate remote desktop protocol on the victim machine. Separately, SonicWall released a security update for its Secure Mobile Access 100 line of devices after disclosing CVE-2021-20034, a critical vulnerability with a severity score of 9.1 out of 10 that could let unauthenticated attackers remotely gain admin access.
Key Takeaway: The Amnesty impersonation turns a high-profile human rights report into bait, and the payload is a RAT that can switch on RDP - giving an adversary a direct path to the desktop. SonicWall's 9.1 flaw lands on a device already targeted by ransomware crews going after end-of-life versions.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Mentions
- CVE-2021-20034
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026